ci starts bisection 2023-09-22 19:28:53.761538946 +0000 UTC m=+807877.780662958
bisecting cause commit starting from 62d8779610bb7a7b8f9c7ab8bf317193ebe76d93
building syzkaller on f3921d4d63f97d1f1fb49a69ea85744bb7ef184b
ensuring issue is reproducible on original commit 62d8779610bb7a7b8f9c7ab8bf317193ebe76d93

testing commit 62d8779610bb7a7b8f9c7ab8bf317193ebe76d93 gcc
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 1a8b2a03eba4af1598ff1636d863c134029858b73f8c72b33d18ca00d6f32d4e
run #0: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
run #1: crashed: possible deadlock in console_flush_all
run #2: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
run #3: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
run #4: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
run #5: crashed: general protection fault in refill_obj_stock
run #6: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
run #7: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
run #8: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
run #9: crashed: general protection fault in ipv6_chk_mcast_addr
run #10: crashed: general protection fault in bio_uninit
run #11: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
run #12: crashed: general protection fault in refill_obj_stock
run #13: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
run #14: crashed: KASAN: use-after-free Read in hfsplus_read_wrapper
run #15: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
run #16: crashed: KASAN: use-after-free Read in hfsplus_read_wrapper
run #17: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
run #18: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
run #19: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
representative crash: KASAN: slab-use-after-free Read in hfsplus_read_wrapper, types: [KASAN]
check whether we can drop unnecessary instrumentation
disabling configs for [LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG], they are not needed
testing commit 62d8779610bb7a7b8f9c7ab8bf317193ebe76d93 gcc
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 5c6b9765d70a82bcff306f5a3907634ebb7c4fe016988384a68dfaf5bd5c4ee2
run #0: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
run #1: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
run #2: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
run #3: crashed: general protection fault in ipv6_chk_mcast_addr
run #4: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
run #5: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
run #6: crashed: general protection fault in add_grec
run #7: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
run #8: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
run #9: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
representative crash: KASAN: slab-use-after-free Read in hfsplus_read_wrapper, types: [KASAN]
the bug reproduces without the instrumentation
disabling configs for [BUG LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN], they are not needed
kconfig minimization: base=3883 full=7594 leaves diff=2000
split chunks (needed=false): <2000>
split chunk #0 of len 2000 into 5 parts
testing without sub-chunk 1/5
disabling configs for [UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG LEAK], they are not needed
testing commit 62d8779610bb7a7b8f9c7ab8bf317193ebe76d93 gcc
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 65b23564af64ba1ee5818ff426a2bfd3fd99bbabc50809c0e552b86dc2b23d73
run #0: crashed: general protection fault in ip6_dst_check
run #1: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
run #2: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
run #3: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
run #4: crashed: general protection fault in refill_obj_stock
run #5: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
run #6: crashed: general protection fault in __find_rr_leaf
run #7: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
run #8: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
run #9: crashed: general protection fault in refill_obj_stock
representative crash: KASAN: slab-use-after-free Read in hfsplus_read_wrapper, types: [KASAN UNKNOWN]
the chunk can be dropped
testing without sub-chunk 2/5
disabling configs for [LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG], they are not needed
testing commit 62d8779610bb7a7b8f9c7ab8bf317193ebe76d93 gcc
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 6d23428a326c75807748df5ce710799fbb91c0420a9705f7aa18e3d2d5036701
all runs: OK
false negative chance: 0.000
testing without sub-chunk 3/5
disabling configs for [UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG LEAK], they are not needed
testing commit 62d8779610bb7a7b8f9c7ab8bf317193ebe76d93 gcc
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: e53d939b5999476f65a6ab2babcdf55b48088c232896e69170f682517f493673
run #0: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
run #1: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
run #2: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
run #3: crashed: general protection fault in cpuacct_charge
run #4: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
run #5: crashed: general protection fault in bio_uninit
run #6: crashed: general protection fault in bio_uninit
run #7: crashed: general protection fault in bio_uninit
run #8: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
run #9: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
representative crash: KASAN: slab-use-after-free Read in hfsplus_read_wrapper, types: [KASAN UNKNOWN]
the chunk can be dropped
testing without sub-chunk 4/5
disabling configs for [HANG LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP], they are not needed
testing commit 62d8779610bb7a7b8f9c7ab8bf317193ebe76d93 gcc
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 5e9828432afce804f25cf495c2ccb307d4d7ea643168a1a39d3197730d090dbc
run #0: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
run #1: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
run #2: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
run #3: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
run #4: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
run #5: crashed: general protection fault in refill_obj_stock
run #6: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
run #7: crashed: general protection fault in __find_rr_leaf
run #8: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
run #9: crashed: BUG: unable to handle kernel NULL pointer dereference in rcu_core
representative crash: KASAN: slab-use-after-free Read in hfsplus_read_wrapper, types: [KASAN UNKNOWN]
the chunk can be dropped
testing without sub-chunk 5/5
disabling configs for [HANG LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP], they are not needed
testing commit 62d8779610bb7a7b8f9c7ab8bf317193ebe76d93 gcc
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: ec3e35b74696b848f6fbb66d9fffe4567aae69cd6088746bf97feffe567d7cfa
run #0: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
run #1: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
run #2: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
run #3: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
run #4: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
run #5: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
run #6: crashed: general protection fault in bio_uninit
run #7: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
run #8: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
run #9: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
representative crash: KASAN: slab-use-after-free Read in hfsplus_read_wrapper, types: [KASAN]
the chunk can be dropped
minimized to 400 configs; suspects: [6LOWPAN ARCH_ENABLE_MEMORY_HOTREMOVE ASUS_WMI CMA COMMON_CLK DAX DLM DRM DRM_BRIDGE DRM_DISPLAY_DP_HELPER DRM_DISPLAY_HDCP_HELPER DRM_DISPLAY_HDMI_HELPER DRM_DISPLAY_HELPER DRM_DP_AUX_BUS DRM_DP_AUX_CHARDEV DRM_FBDEV_EMULATION DRM_GEM_SHMEM_HELPER DRM_I915 DRM_I915_CAPTURE_ERROR DRM_I915_COMPRESS_ERROR DRM_I915_USERPTR DRM_KMS_HELPER DRM_MIPI_DSI DRM_PANEL DRM_PANEL_BRIDGE DRM_PANEL_EDP DRM_PANEL_ORIENTATION_QUIRKS DRM_SIMPLEDRM DRM_TTM DRM_TTM_HELPER DRM_UDL DRM_VGEM DRM_VIRTIO_GPU DRM_VIRTIO_GPU_KMS DRM_VKMS DRM_VMWGFX DRM_VRAM_HELPER DUMMY DVB_AF9013 DVB_AF9033 DVB_AS102 DVB_AS102_FE DVB_B2C2_FLEXCOP DVB_B2C2_FLEXCOP_USB DVB_CORE DVB_DIB3000MB DVB_DIB3000MC DVB_EC100 DVB_GP8PSK_FE DVB_RTL2830 DVB_RTL2832 DVB_RTL2832_SDR DVB_TEST_DRIVERS DVB_TTUSB_BUDGET DVB_TTUSB_DEC DVB_USB DVB_USB_A800 DVB_USB_AF9005 DVB_USB_AF9005_REMOTE DVB_USB_AF9015 DVB_USB_AF9035 DVB_USB_ANYSEE DVB_USB_AU6610 DVB_USB_AZ6007 DVB_USB_AZ6027 DVB_USB_CE6230 DVB_USB_CINERGY_T2 DVB_USB_CXUSB DVB_USB_DIB0700 DVB_USB_DIB3000MC DVB_USB_DIBUSB_MB DVB_USB_DIBUSB_MC DVB_USB_DIGITV DVB_USB_DTT200U DVB_USB_DTV5100 DVB_USB_DVBSKY DVB_USB_DW2102 DVB_USB_EC168 DVB_USB_GL861 DVB_USB_GP8PSK DVB_USB_LME2510 DVB_USB_M920X DVB_USB_MXL111SF DVB_USB_NOVA_T_USB2 DVB_USB_OPERA1 DVB_USB_PCTV452E DVB_USB_RTL28XXU DVB_USB_TECHNISAT_USB2 DVB_USB_TTUSB2 DVB_USB_UMT_010 DVB_USB_V2 DVB_USB_VP702X DVB_USB_VP7045 DVB_USB_ZD1301 DVB_VIDTV DVB_ZL10353 ECRYPT_FS ECRYPT_FS_MESSAGING EDAC EEPROM_93CX6 EFS_FS ENCRYPTED_KEYS EQUALIZER EROFS_FS EROFS_FS_POSIX_ACL EROFS_FS_SECURITY EROFS_FS_XATTR EROFS_FS_ZIP EVM EVM_ADD_XATTRS EVM_ATTR_FSUUID EXFAT_FS EXPORTFS_BLOCK_OPS EXT3_FS EXT3_FS_POSIX_ACL EXT3_FS_SECURITY EXTCON EXTCON_INTEL_CHT_WC F2FS_CHECK_FS F2FS_FAULT_INJECTION F2FS_FS F2FS_FS_COMPRESSION F2FS_FS_LZ4 F2FS_FS_LZ4HC F2FS_FS_LZO F2FS_FS_LZORLE F2FS_FS_POSIX_ACL F2FS_FS_SECURITY F2FS_FS_XATTR F2FS_FS_ZSTD F2FS_STAT_FS FANOTIFY FANOTIFY_ACCESS_PERMISSIONS FB FB_CFB_COPYAREA FB_CFB_FILLRECT FB_CFB_IMAGEBLIT FB_DEFERRED_IO FB_NOTIFY FB_SYS_COPYAREA FB_SYS_FILLRECT FB_SYS_FOPS FB_SYS_IMAGEBLIT FB_TILEBLITTING FB_VESA FB_VGA16 FB_VIRTUAL FDDI FIREWIRE FIREWIRE_NET FIREWIRE_OHCI FIREWIRE_SBP2 FONT_8x16 FONT_8x8 FONT_SUPPORT FRAMEBUFFER_CONSOLE FRAMEBUFFER_CONSOLE_DETECT_PRIMARY FRAMEBUFFER_CONSOLE_ROTATION FRONTSWAP FS_DAX FS_DAX_PMD FS_ENCRYPTION FS_ENCRYPTION_ALGS FS_VERITY FS_VERITY_BUILTIN_SIGNATURES FTL FUSE_DAX FUSE_FS FW_LOADER_COMPRESS FW_LOADER_PAGED_BUF FW_LOADER_SYSFS FW_LOADER_USER_HELPER FW_LOADER_USER_HELPER_FALLBACK GACT_PROB GARP GENERIC_PHY GET_FREE_REGION GFS2_FS GFS2_FS_LOCKING_DLM GOOGLE_COREBOOT_TABLE GOOGLE_FIRMWARE GOOGLE_MEMCONSOLE GOOGLE_MEMCONSOLE_COREBOOT GOOGLE_VPD GPIOLIB GPIOLIB_IRQCHIP GPIO_ACPI GPIO_DLN2 GPIO_VIPERBOARD GREENASIA_FF GREYBUS GREYBUS_BRIDGED_PHY GREYBUS_ES2 GREYBUS_HID GREYBUS_USB GTP GUEST_PERF_EVENTS GVE HAVE_ARCH_NODE_DEV_GROUP HAVE_ARCH_USERFAULTFD_MINOR HAVE_ARCH_USERFAULTFD_WP HAVE_BOOTMEM_INFO_NODE HAVE_CLK_PREPARE HAVE_HARDENED_USERCOPY_ALLOCATOR HAVE_KVM_CPU_RELAX_INTERCEPT HAVE_KVM_DIRTY_RING HAVE_KVM_DIRTY_RING_ACQ_REL HAVE_KVM_DIRTY_RING_TSO HAVE_KVM_EVENTFD HAVE_KVM_IRQCHIP HAVE_KVM_IRQFD HAVE_KVM_IRQ_BYPASS HAVE_KVM_IRQ_ROUTING HAVE_KVM_MSI HAVE_KVM_NO_POLL HAVE_KVM_PFNCACHE HAVE_KVM_PM_NOTIFIER HAVE_SCHED_AVG_IRQ HDLC HDLC_CISCO HDLC_FR HDLC_PPP HDLC_RAW HDLC_RAW_ETH HDLC_X25 HDMI HFSPLUS_FS HFS_FS HID_ACCUTOUCH HID_ACRUX HID_ACRUX_FF HID_ALPS HID_APPLEIR HID_ASUS HID_AUREAL HID_BATTERY_STRENGTH HID_BETOP_FF HID_CMEDIA HID_CORSAIR HID_CP2112 HID_ELECOM HID_ELO HID_EMS_FF HID_GEMBIRD HID_GFRM HID_GREENASIA HID_GT683R HID_HOLTEK HID_ICADE HID_KEYTOUCH HID_KYE HID_LCPOWER HID_LED HID_LENOVO HID_LOGITECH_DJ HID_LOGITECH_HIDPP HID_MAGICMOUSE HID_MAYFLASH HID_MULTITOUCH HID_NTI HID_ORTEK HID_PENMOUNT HID_PICOLCD HID_PICOLCD_BACKLIGHT HID_PICOLCD_CIR HID_PICOLCD_FB HID_PICOLCD_LCD HID_PICOLCD_LEDS HID_PLANTRONICS HID_PRIMAX HID_PRODIKEYS HID_RETRODE HID_RMI HID_ROCCAT HID_SAITEK HID_SENSOR_ACCEL_3D HID_SENSOR_ALS HID_SENSOR_CUSTOM_SENSOR HID_SENSOR_DEVICE_ROTATION HID_SENSOR_GYRO_3D HID_SENSOR_HUB HID_SENSOR_HUMIDITY HID_SENSOR_IIO_COMMON HID_SENSOR_IIO_TRIGGER HID_SENSOR_INCLINOMETER_3D HID_SENSOR_MAGNETOMETER_3D HID_SENSOR_PRESS HID_SENSOR_PROX HID_SENSOR_TEMP HID_SPEEDLINK HID_STEELSERIES HID_THINGM HID_TIVO HID_TWINHAN HID_UCLOGIC HID_UDRAW_PS3 HID_WACOM HID_WALTOP HID_WIIMOTE HID_XINMO HID_ZYDACRON HMM_MIRROR HOLTEK_FF HOTPLUG_PCI_PCIE HPET_MMAP HPET_MMAP_DEFAULT HPFS_FS I2C_ALGOBIT I2C_CHARDEV I2C_DESIGNWARE_CORE I2C_DESIGNWARE_PLATFORM I2C_DIOLAN_U2C I2C_DLN2 I2C_MUX I2C_MUX_REG I2C_ROBOTFUZZ_OSIF I2C_SI4713 I2C_SLAVE I2C_SLAVE_EEPROM I2C_TINY_USB I2C_VIPERBOARD IEEE802154 IEEE802154_6LOWPAN IEEE802154_ATUSB IEEE802154_DRIVERS IEEE802154_HWSIM IEEE802154_NL802154_EXPERIMENTAL IEEE802154_SOCKET IFB IIO IIO_BUFFER IIO_KFIFO_BUF IIO_TRIGGER IIO_TRIGGERED_BUFFER IKCONFIG IKCONFIG_PROC IMA IMA_APPRAISE IMA_APPRAISE_MODSIG IMA_DEFAULT_HASH_SHA256 IMA_LSM_RULES IMA_MEASURE_ASYMMETRIC_KEYS IMA_NG_TEMPLATE IMA_QUEUE_EARLY_BOOT_KEYS IMA_READ_POLICY IMA_WRITE_POLICY INET6_ESPINTCP INET6_ESP_OFFLOAD INET6_IPCOMP INET6_TUNNEL INET6_XFRM_TUNNEL INET_AH INET_DCCP_DIAG INET_DIAG INET_DIAG_DESTROY INET_ESP INET_ESPINTCP INET_ESP_OFFLOAD INET_IPCOMP INET_MPTCP_DIAG INET_RAW_DIAG INET_SCTP_DIAG INET_TCP_DIAG INET_UDP_DIAG INET_XFRM_TUNNEL INFINIBAND INFINIBAND_ADDR_TRANS INFINIBAND_ADDR_TRANS_CONFIGFS INFINIBAND_IPOIB INFINIBAND_IPOIB_CM INFINIBAND_IPOIB_DEBUG INFINIBAND_ISER INFINIBAND_ON_DEMAND_PAGING INFINIBAND_RTRS INFINIBAND_SRP INFINIBAND_USER_ACCESS INFINIBAND_USER_MAD INFINIBAND_USER_MEM INIT_STACK_NONE INPUT_ATI_REMOTE2 INPUT_CM109 INPUT_IMS_PCU INPUT_JOYDEV INPUT_KEYSPAN_REMOTE INPUT_LEDS INPUT_MOUSEDEV INPUT_MOUSEDEV_PSAUX INPUT_POWERMATE INPUT_UINPUT INPUT_YEALINK INTEGRITY INTEGRITY_ASYMMETRIC_KEYS INTEGRITY_AUDIT INTEGRITY_SIGNATURE INTEGRITY_TRUSTED_KEYRING INTEL_IDMA64 INTEL_IOATDMA INTEL_IOMMU_DEFAULT_ON INTEL_IOMMU_SVM INTEL_ISH_HID INTEL_SOC_PMIC_CHTWC INTERVAL_TREE INTERVAL_TREE_SPAN_ITER IOMMUFD IOMMUFD_TEST IOMMU_SVA IP6_NF_MATCH_AH IP6_NF_MATCH_EUI64 IP6_NF_MATCH_FRAG IP6_NF_MATCH_HL IP6_NF_MATCH_MH IP6_NF_MATCH_OPTS IP6_NF_MATCH_RPFILTER IP6_NF_MATCH_RT IP6_NF_MATCH_SRH IP6_NF_NAT IP6_NF_RAW IP6_NF_SECURITY IP6_NF_TARGET_HL IP6_NF_TARGET_MASQUERADE IP6_NF_TARGET_NPT IP6_NF_TARGET_SYNPROXY IPV6_FOU IPV6_FOU_TUNNEL IPV6_GRE IPV6_ILA IPV6_MIP6 IPV6_MROUTE IPV6_MROUTE_MULTIPLE_TABLES IPV6_MULTIPLE_TABLES IPV6_OPTIMISTIC_DAD IPV6_PIMSM_V2 IPV6_ROUTER_PREF IPV6_ROUTE_INFO IPV6_RPL_LWTUNNEL IPV6_SEG6_BPF IPV6_SEG6_HMAC IPV6_SEG6_LWTUNNEL IPV6_SIT_6RD IPV6_SUBTREES IPV6_TUNNEL IPV6_VTI IPVLAN IPVLAN_L3S IPVTAP IP_DCCP IP_DCCP_CCID3 IP_DCCP_TFRC_LIB IP_FIB_TRIE_STATS IP_MROUTE_MULTIPLE_TABLES IP_NF_ARPFILTER IP_NF_ARPTABLES IP_NF_ARP_MANGLE IP_NF_MATCH_AH IP_NF_MATCH_ECN IP_NF_MATCH_RPFILTER IP_NF_MATCH_TTL IP_NF_RAW IP_NF_SECURITY IP_NF_TARGET_ECN IP_NF_TARGET_NETMAP IP_NF_TARGET_REDIRECT IP_NF_TARGET_SYNPROXY IP_NF_TARGET_TTL IP_ROUTE_CLASSID IP_SCTP IP_SET IP_SET_BITMAP_IP IP_SET_BITMAP_IPMAC IP_SET_BITMAP_PORT IP_SET_HASH_IP IP_SET_HASH_IPMAC IP_SET_HASH_IPMARK IP_SET_HASH_IPPORT IP_SET_HASH_IPPORTIP IP_SET_HASH_IPPORTNET IP_SET_HASH_MAC IP_SET_HASH_NET IP_SET_HASH_NETIFACE IP_SET_HASH_NETNET IP_SET_HASH_NETPORT IP_SET_HASH_NETPORTNET IP_SET_LIST_SET IP_VS IP_VS_DH IP_VS_FO IP_VS_FTP IP_VS_IPV6 IP_VS_LBLC IP_VS_LBLCR IP_VS_LC IP_VS_MH IP_VS_NFCT IP_VS_NQ IP_VS_OVF IP_VS_PE_SIP IP_VS_PROTO_TCP IP_VS_PROTO_UDP IRQ_TIME_ACCOUNTING LAPB LCD_CLASS_DEVICE MAC802154 MEDIA_DIGITAL_TV_SUPPORT MEDIA_RADIO_SUPPORT MEDIA_SDR_SUPPORT MEDIA_SUPPORT MEDIA_TEST_SUPPORT MEDIA_USB_SUPPORT MEMORY_HOTPLUG MEMORY_HOTREMOVE MFD_DLN2 MFD_VIPERBOARD MPTCP MTD NETFILTER_ADVANCED NET_ACT_GACT NET_ACT_MIRRED NET_IPGRE_DEMUX NFT_FWD_NETDEV NF_TABLES NF_TABLES_NETDEV RADIO_ADAPTERS RADIO_SI4713 RAS RC_CORE RFKILL SND SOUND STAGING TRANSPARENT_HUGEPAGE VIDEO_DEV VIRTIO_FS WAN ZONE_DEVICE]
disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN BUG], they are not needed
picked [v6.3 v6.2 v6.1 v5.19 v5.17 v5.15 v5.13 v5.11 v5.8 v5.5 v5.2 v4.20 v4.19] out of 26 release tags
testing release v6.3
testing commit 457391b0380335d5e9a5babdec90ac53928b23b4 gcc
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: d3efff743ab4e0c6c946a6706565854042a618c75908ca7aabccfe572cf25b7e
run #0: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
run #1: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
run #2: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
run #3: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
run #4: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
run #5: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
run #6: crashed: general protection fault in blkcg_iolatency_done_bio
run #7: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
run #8: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
run #9: crashed: KASAN: slab-use-after-free Read in hfsplus_read_wrapper
representative crash: KASAN: slab-use-after-free Read in hfsplus_read_wrapper, types: [KASAN]
testing release v6.2
testing commit c9c3395d5e3dcc6daee66c6908354d47bf98cb0c gcc
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 0d9e90bc5fd1dcaf50afbbd74c8d08f573f741b9f8f5eea91c3ec25dc7f645dd
all runs: crashed: KASAN: slab-out-of-bounds Read in generic_perform_write
representative crash: KASAN: slab-out-of-bounds Read in generic_perform_write, types: [KASAN]
testing release v6.1
testing commit 830b3c68c1fb1e9176028d02ef86f3cf76aa2476 gcc
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 5848f214bddb45065dc3149b4ebec6fce4142760c4361d99f41fdf4344efda52
run #0: crashed: KASAN: slab-out-of-bounds Read in generic_perform_write
run #1: crashed: KASAN: slab-out-of-bounds Write in shmem_file_read_iter
run #2: crashed: KASAN: slab-out-of-bounds Read in generic_perform_write
run #3: crashed: KASAN: slab-out-of-bounds Write in shmem_file_read_iter
run #4: crashed: KASAN: slab-out-of-bounds Read in generic_perform_write
run #5: crashed: KASAN: slab-out-of-bounds Read in generic_perform_write
run #6: crashed: KASAN: slab-out-of-bounds Read in generic_perform_write
run #7: crashed: KASAN: slab-out-of-bounds Read in generic_perform_write
run #8: crashed: KASAN: slab-out-of-bounds Read in generic_perform_write
run #9: crashed: KASAN: slab-out-of-bounds Write in shmem_file_read_iter
representative crash: KASAN: slab-out-of-bounds Read in generic_perform_write, types: [KASAN]
testing release v5.19
testing commit 3d7cb6b04c3f3115719235cc6866b10326de34cd gcc
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 5c7075847849d7c69bd1645681583226475ce1fdbbf4928401b4fd7e060d2041
run #0: crashed: KASAN: slab-out-of-bounds Write in shmem_file_read_iter
run #1: crashed: KASAN: slab-out-of-bounds Write in shmem_file_read_iter
run #2: crashed: KASAN: slab-out-of-bounds Read in generic_perform_write
run #3: crashed: KASAN: slab-out-of-bounds Write in shmem_file_read_iter
run #4: crashed: KASAN: slab-out-of-bounds Write in shmem_file_read_iter
run #5: crashed: KASAN: slab-out-of-bounds Write in shmem_file_read_iter
run #6: crashed: KASAN: slab-out-of-bounds Write in shmem_file_read_iter
run #7: crashed: KASAN: slab-out-of-bounds Write in shmem_file_read_iter
run #8: crashed: KASAN: slab-out-of-bounds Read in generic_perform_write
run #9: crashed: KASAN: slab-out-of-bounds Read in generic_perform_write
representative crash: KASAN: slab-out-of-bounds Write in shmem_file_read_iter, types: [KASAN]
testing release v5.17
testing commit f443e374ae131c168a065ea1748feac6b2e76613 gcc
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 19f743be9b9d7990cdf661a43d4cb071d051ace314ae8b8eb153beeb1b19e1fa
all runs: crashed: KASAN: slab-out-of-bounds Read in generic_perform_write
representative crash: KASAN: slab-out-of-bounds Read in generic_perform_write, types: [KASAN]
testing release v5.15
testing commit 8bb7eca972ad531c9b149c0a51ab43a417385813 gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: a03c86360f8f0b67a5121f3f202f0a3c9fba8a0f57fb2799176a22b965465d86
all runs: crashed: KASAN: slab-out-of-bounds Read in generic_perform_write
representative crash: KASAN: slab-out-of-bounds Read in generic_perform_write, types: [KASAN]
testing release v5.13
testing commit 62fb9874f5da54fdb243003b386128037319b219 gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: c2d798aba18671009b6095677ded4304b1ae340355a13b90e4fd2c6f4e664bda
all runs: crashed: KASAN: slab-out-of-bounds Read in generic_perform_write
representative crash: KASAN: slab-out-of-bounds Read in generic_perform_write, types: [KASAN]
testing release v5.11
testing commit f40ddce88593482919761f74910f42f4b84c004b gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: c3810a9ad5eedf2e1710477921a266b00860523f95a7467635a71db34c5edf62
all runs: crashed: KASAN: slab-out-of-bounds Read in generic_perform_write
representative crash: KASAN: slab-out-of-bounds Read in generic_perform_write, types: [KASAN]
testing release v5.8
testing commit bcf876870b95592b52519ed4aafcf9d95999bc9c gcc
compiler: gcc (GCC) 8.4.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 6cc5046a4dd274b187be24ea24a5bd6a30f05f2f68912b8d18fd5f712e7186aa
all runs: crashed: KASAN: slab-out-of-bounds Read in generic_perform_write
representative crash: KASAN: slab-out-of-bounds Read in generic_perform_write, types: [KASAN]
testing release v5.5
testing commit d5226fa6dbae0569ee43ecfc08bdcd6770fc4755 gcc
compiler: gcc version 8.4.1 20210217 (GCC)
kernel signature: fcd1244817933d17b3fca63b06190ca9ef03f0159662fef9036d3c80618ef842
all runs: crashed: KASAN: slab-out-of-bounds Read in generic_perform_write
representative crash: KASAN: slab-out-of-bounds Read in generic_perform_write, types: [KASAN]
testing release v5.2
testing commit 0ecfebd2b52404ae0c54a878c872bb93363ada36 gcc
compiler: gcc version 8.4.1 20210217 (GCC)
kernel signature: 33352b1e9a9c2d3bcd5c3c82c5418e65bb053ad766801e7fc885fa73f3a2edad
all runs: crashed: KASAN: slab-out-of-bounds Read in generic_perform_write
representative crash: KASAN: slab-out-of-bounds Read in generic_perform_write, types: [KASAN]
testing release v4.20
testing commit 8fe28cb58bcb235034b64cbbb7550a8a43fd88be gcc
compiler: gcc version 8.4.1 20210217 (GCC)
kernel signature: 7fd6c5d441ac4b6f4fcf653d2e720a059bf8f947eeacaecb305a0e583b6986c6
all runs: crashed: KASAN: slab-out-of-bounds Read in generic_perform_write
representative crash: KASAN: slab-out-of-bounds Read in generic_perform_write, types: [KASAN]
testing release v4.19
testing commit 84df9525b0c27f3ebc2ebb1864fa62a97fdedb7d gcc
compiler: gcc version 8.4.1 20210217 (GCC)
kernel signature: 96b80b3b0a591cddc89cf32281a6d353a64669a1af2550e1457895a919055fa0
all runs: crashed: KASAN: slab-out-of-bounds Read in generic_perform_write
representative crash: KASAN: slab-out-of-bounds Read in generic_perform_write, types: [KASAN]
crash still not fixed/happens on the oldest tested release
revisions tested: 20, total time: 3h45m45.977711051s (build: 2h24m28.989402647s, test: 1h9m8.039851802s)
oldest tested release already had the bug or it had kernel test errors
commit msg: Linux 4.19
crash: KASAN: slab-out-of-bounds Read in generic_perform_write
hfsplus: unable to find HFS+ superblock
hfsplus: unable to find HFS+ superblock
hfsplus: unable to find HFS+ superblock
hfsplus: unable to find HFS+ superblock
==================================================================
BUG: KASAN: slab-out-of-bounds in memcpy include/linux/string.h:345 [inline]
BUG: KASAN: slab-out-of-bounds in memcpy_from_page+0x73/0xe0 lib/iov_iter.c:453
Read of size 2048 at addr ffff8801efbac780 by task loop0/5139

CPU: 1 PID: 5139 Comm: loop0 Not tainted 4.19.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x10c/0x17a lib/dump_stack.c:113
 print_address_description.cold.6+0x9/0x244 mm/kasan/report.c:256
 kasan_report_error mm/kasan/report.c:354 [inline]
 kasan_report mm/kasan/report.c:412 [inline]
 kasan_report.cold.7+0x242/0x305 mm/kasan/report.c:396
 check_memory_region_inline mm/kasan/kasan.c:260 [inline]
 check_memory_region+0x13c/0x1b0 mm/kasan/kasan.c:267
 memcpy+0x23/0x50 mm/kasan/kasan.c:302
 memcpy include/linux/string.h:345 [inline]
 memcpy_from_page+0x73/0xe0 lib/iov_iter.c:453
 iov_iter_copy_from_user_atomic+0x478/0x980 lib/iov_iter.c:916
 generic_perform_write+0x291/0x470 mm/filemap.c:3147
 __generic_file_write_iter+0x205/0x590 mm/filemap.c:3264
 generic_file_write_iter+0x302/0x660 mm/filemap.c:3292
 call_write_iter include/linux/fs.h:1808 [inline]
 do_iter_readv_writev+0x4ae/0x960 fs/read_write.c:680
 do_iter_write fs/read_write.c:959 [inline]
 do_iter_write+0x12a/0x510 fs/read_write.c:940
 vfs_iter_write+0x5b/0xb0 fs/read_write.c:972
 lo_write_bvec+0x127/0x310 drivers/block/loop.c:274
 lo_write_simple drivers/block/loop.c:296 [inline]
 do_req_filebacked drivers/block/loop.c:608 [inline]
 loop_handle_cmd drivers/block/loop.c:1786 [inline]
 loop_queue_work+0xac5/0x1ffb drivers/block/loop.c:1800
 kthread_worker_fn+0x1ff/0x640 kernel/kthread.c:662
 loop_kthread_worker_fn+0x4c/0x60 drivers/block/loop.c:890
 kthread+0x2ef/0x3a0 kernel/kthread.c:246
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:413

Allocated by task 5137:
 save_stack mm/kasan/kasan.c:448 [inline]
 set_track mm/kasan/kasan.c:460 [inline]
 kasan_kmalloc.part.1+0x62/0xf0 mm/kasan/kasan.c:553
 kasan_kmalloc+0xaf/0xc0 mm/kasan/kasan.c:538
 __kmalloc+0x139/0x260 mm/slub.c:3751
 kmalloc include/linux/slab.h:518 [inline]
 hfsplus_read_wrapper+0xa1b/0xee0 fs/hfsplus/wrapper.c:177
 hfsplus_fill_super+0x2e4/0x1770 fs/hfsplus/super.c:413
 mount_bdev+0x26f/0x330 fs/super.c:1158
 hfsplus_mount+0x10/0x20 fs/hfsplus/super.c:648
 mount_fs+0x7f/0x1f0 fs/super.c:1261
 vfs_kern_mount.part.11+0x58/0x3d0 fs/namespace.c:961
 vfs_kern_mount fs/namespace.c:951 [inline]
 do_new_mount fs/namespace.c:2457 [inline]
 do_mount+0x376/0x26e0 fs/namespace.c:2787
 ksys_mount+0xb1/0xd0 fs/namespace.c:3003
 __do_sys_mount fs/namespace.c:3017 [inline]
 __se_sys_mount fs/namespace.c:3014 [inline]
 __x64_sys_mount+0xb9/0x150 fs/namespace.c:3014
 do_syscall_64+0xca/0x340 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Freed by task 2622:
 save_stack mm/kasan/kasan.c:448 [inline]
 set_track mm/kasan/kasan.c:460 [inline]
 __kasan_slab_free+0x167/0x240 mm/kasan/kasan.c:521
 kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
 slab_free_hook mm/slub.c:1371 [inline]
 slab_free_freelist_hook mm/slub.c:1398 [inline]
 slab_free mm/slub.c:2953 [inline]
 kfree+0x10c/0x270 mm/slub.c:3906
 skb_free_head+0x74/0x90 net/core/skbuff.c:550
 skb_release_data+0x4cf/0x670 net/core/skbuff.c:570
 skb_release_all+0x3d/0x50 net/core/skbuff.c:627
 __kfree_skb net/core/skbuff.c:641 [inline]
 consume_skb+0xaf/0x1d0 net/core/skbuff.c:701
 netlink_broadcast_filtered+0x288/0x900 net/netlink/af_netlink.c:1519
 netlink_broadcast+0xe/0x10 net/netlink/af_netlink.c:1541
 nlmsg_multicast include/net/netlink.h:591 [inline]
 nlmsg_notify+0x107/0x140 net/netlink/af_netlink.c:2497
 rtnl_notify+0x86/0xe0 net/core/rtnetlink.c:736
 rtmsg_ifa+0x11e/0x190 net/ipv4/devinet.c:1725
 __inet_insert_ifa+0x5e0/0xb30 net/ipv4/devinet.c:518
 inet_rtm_newaddr+0xb7f/0x13c0 net/ipv4/devinet.c:910
 rtnetlink_rcv_msg+0x676/0x9d0 net/core/rtnetlink.c:4730
 netlink_rcv_skb+0x13c/0x380 net/netlink/af_netlink.c:2454
 rtnetlink_rcv+0x10/0x20 net/core/rtnetlink.c:4748
 netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline]
 netlink_unicast+0x43d/0x650 net/netlink/af_netlink.c:1343
 netlink_sendmsg+0x680/0xc00 net/netlink/af_netlink.c:1908
 sock_sendmsg_nosec net/socket.c:621 [inline]
 sock_sendmsg net/socket.c:631 [inline]
 sock_sendmsg+0xac/0xf0 net/socket.c:626
 __sys_sendto+0x1d8/0x2a0 net/socket.c:1788
 __do_sys_sendto net/socket.c:1800 [inline]
 __se_sys_sendto net/socket.c:1796 [inline]
 __x64_sys_sendto+0xdc/0x1a0 net/socket.c:1796
 do_syscall_64+0xca/0x340 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

The buggy address belongs to the object at ffff8801efbac780
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 0 bytes inside of
 512-byte region [ffff8801efbac780, ffff8801efbac980)
The buggy address belongs to the page:
page:ffffea0007beeb00 count:1 mapcount:0 mapping:ffff8801f6802c00 index:0x0 compound_mapcount: 0
flags: 0x100000000008100(slab|head)
raw: 0100000000008100 dead000000000100 dead000000000200 ffff8801f6802c00
raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page allocated via order 1, migratetype Unmovable, gfp_mask 0x152c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC)
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook mm/page_alloc.c:1906 [inline]
 prep_new_page mm/page_alloc.c:1914 [inline]
 get_page_from_freelist+0x2bf3/0x4050 mm/page_alloc.c:3345
 __alloc_pages_nodemask+0x390/0x2300 mm/page_alloc.c:4370
 __alloc_pages include/linux/gfp.h:473 [inline]
 alloc_page_interleave+0x14/0x130 mm/mempolicy.c:1974
 alloc_pages_current+0x1ef/0x290 mm/mempolicy.c:2091
 alloc_pages include/linux/gfp.h:509 [inline]
 alloc_slab_page mm/slub.c:1438 [inline]
 allocate_slab mm/slub.c:1583 [inline]
 new_slab+0x44b/0x7b0 mm/slub.c:1654
 new_slab_objects mm/slub.c:2417 [inline]
 ___slab_alloc+0x600/0x890 mm/slub.c:2569
 __slab_alloc+0x2f/0x60 mm/slub.c:2609
 slab_alloc_node mm/slub.c:2672 [inline]
 kmem_cache_alloc_node_trace+0xb6/0x240 mm/slub.c:2756
 kmalloc_node include/linux/slab.h:551 [inline]
 kzalloc_node include/linux/slab.h:718 [inline]
 iolatency_pd_alloc+0x4c/0xe0 block/blk-iolatency.c:858
 blkcg_activate_policy block/blk-cgroup.c:1405 [inline]
 blkcg_activate_policy+0xcb/0x510 block/blk-cgroup.c:1389
 blk_iolatency_init+0x11e/0x280 block/blk-iolatency.c:712
 blkcg_init_queue+0x160/0x290 block/blk-cgroup.c:1240
 blk_alloc_queue_node+0x726/0xab0 block/blk-core.c:1077
 blk_mq_init_queue+0x3e/0x90 block/blk-mq.c:2483
 loop_add+0x274/0x800 drivers/block/loop.c:1856
 loop_init+0x174/0x1c5 drivers/block/loop.c:2122

Memory state around the buggy address:
 ffff8801efbac880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8801efbac900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff8801efbac980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                   ^
 ffff8801efbaca00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8801efbaca80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================